INTRODUCTION
The physician-patient relationship has historically been constituted by trust, knowledge asymmetry, and a moral obligation that the law has consistently treated as sui generis. Indian courts, following the common law tradition, recognised early that medicine resists the transactional logic of ordinary contract: it demands a duty of care that is simultaneously ethical, clinical, and legal. That recognition underpins the entire edifice of medical liability in India, from the foundational holding that medical services fall within the purview of consumer protection legislation1 to the graduated standard of criminal negligence that protects doctors from oppressive prosecution.2
Yet the conditions that justified this framework have fundamentally changed. A senior cardiologist in metropolitan India may simultaneously maintain a hospital outpatient department, a telemedicine platform subscription, a brand-sponsorship arrangement with a pharmaceutical company, and a social media account with several hundred thousand followers. Each of these activities raises distinct legal questions that existing doctrine resolves only incompletely, if at all. The NMC Code of Medical Ethics Regulations, 2002 prohibits solicitation and self-advertisement,3 but it has not kept pace with the algorithmic realities of digital reach. The Consumer Protection Act, 2019 extends liability to “deficiency in service,”4 Yet courts have not yet grappled seriously with deficiency attributable to an AI diagnostic tool rather than to a human clinician.
Three converging phenomena demand scholarly and legislative attention. First, the commercialisation of medicine through advertising has converted clinical reputation into marketable brand equity, creating incentives that are structurally misaligned with patient welfare. Second, the integration of AI-assisted diagnostic tools into mainstream clinical practice has outrun the legal categories available to assign responsibility when those tools produce harmful outputs. Third, the corporatisation of Indian healthcare has relocated effective medical authority from individual practitioners to institutional administrators, while liability doctrine continues to target individual doctors. This article addresses each of these phenomena in turn and proposes an integrated liability reform framework.
THE ARCHITECTURE OF MEDICAL LIABILITY IN INDIA: DOCTRINAL FOUNDATIONS
A. The Standard of Care: From Bolam to Jacob Mathew
Medical negligence in India is governed by the standard formulated in Jacob Mathew v. State of Punjab,5 the Supreme Court’s landmark exposition of criminal medical negligence. The Court drew heavily on the English Bolam test6 a doctor is not negligent if he acts in accordance with a responsible body of professional opinion while establishing critical safeguards against the criminalisation of bona fide clinical error. The Court held that to attract criminal liability under what was then Section 304A of the Indian Penal Code, 1860 (now Section 106 of the Bharatiya Nyaya Sanhita, 2023), negligence must be “gross,” meaning a failure so reprehensible as to merit criminal sanction beyond mere civil remedy.7
This bifurcation between civil and criminal negligence was practically significant. In civil proceedings, the standard remains that of the ordinary competent doctor practising the relevant specialty; the claimant need not establish moral culpability. In criminal proceedings, the elevated gross negligence threshold prevents the mechanistic prosecution of every adverse clinical outcome.8 The Bharatiya Nyaya Sanhita, 2023 has reinforced this distinction: Section 106(1), in its proviso, expressly limits imprisonment for a registered medical practitioner performing a medical procedure to a maximum of two years, even where death results from rashness or negligence, thereby codifying the protective judicial policy of Jacob Mathew into statute.9
B. Consumer Protection and the Medical Services Nexus
The extension of medical services to the domain of consumer law was settled in Indian Medical Association v. V.P. Shantha.10 The Supreme Court held that services rendered by a medical professional for consideration fall within the definition of “service” under what is now Section 2(42) of the Consumer Protection Act, 2019, and that “deficiency” under Section 2(11) of the same Act encompasses deficiencies in the standard, manner, and conduct of such services.11 This holding democratised access to medical redress: patients could now approach the three-tier consumer forum systemdistrict, state, and nationalwithout the technical burden of civil court litigation.
Kusum Sharma v. Batra Hospital and Medical Research Centre12 calibrated the consumer forum approach to negligence, warning against hindsight assessments and emphasising that a doctor is not a guarantor of cure. V. Kishan Rao v. Nikhil Super Speciality Hospital13 further held that expert medical evidence is not invariably necessary in consumer forum proceedings, thereby preserving the accessibility of the consumer redress system. Spring Meadows Hospital v. Harjol Ahluwalia14 established that hospital liability may extend beyond the treating physician to the hospital institution itself a doctrinal foundation directly relevant to the enterprise liability arguments developed later in this article.
C. Informed Consent and Patient Autonomy
The doctrine of informed consent received its most rigorous Indian articulation in Samira Kohli v. Dr. Prabha Manchanda.15 The Supreme Court held that consent to a medical procedure must be “real” and “informed”the patient must receive sufficient information to understand the nature, purpose, and material risks of the proposed procedure.16 The Court adopted a modified patient-centred standard requiring disclosure of risks that a reasonable patient would consider material to a decision to consent, departing from the purely doctor-centred Bolam analysis previously applied to consent questions.17
Common Cause v. Union of India18 extended the autonomy principle to end-of-life decisions, recognising the constitutional right of a terminally ill patient to execute an advance medical directive. The Court situated this right within the right to life and personal liberty under Article 21 of the Constitution of India, confirming that patient autonomy is a constitutionally protected interest and not merely a common law rule. Nizam Institute of Medical Sciences v. Prasanth S. Dhananka19 demonstrated the willingness of Indian courts to award substantial compensation in medical negligence, affirming that the right to health has real remedial content.
MEDICAL ADVERTISING AND THE COMMERCIALISATION OF HEALTHCARE
A. The Ethical Prohibition and Its Erosion
The NMC Code of Medical Ethics Regulations, 2002currently administered by the Ethics and Medical Registration Board (EMRB) constituted under Section 30 of the National Medical Commission Act, 2019unambiguously prohibits medical practitioners from using any medium of advertising to attract patients.20 Regulation 6.1 proscribes solicitation of patients through the use of agents or touts, through enticement, and through any form of communication that amounts to an advertisement of clinical services. Regulation 6.4 prohibits doctors from permitting their names to be used in any advertisement for any purpose that might be construed as professional solicitation.21
These prohibitions reflect a principled position: that the commercialisation of clinical judgment creates incentives incompatible with the primacy of patient welfare. When a doctor’s income is linked to the volume of patients attracted through advertising, the structural pressure is toward over-diagnosis, unnecessary procedures, and selective disclosure of information that converts patients into consumers. The ethical prohibition was designed to insulate clinical judgment from this market logic.
The digital media environment has rendered this prohibition largely ineffective in practice. Physicians with significant social media followings routinely publish clinical content that promotes their services through the demonstration of expertise rather than overt solicitation, a distinction that existing regulations do not adequately capture. Brand partnerships with pharmaceutical companies, diagnostic laboratories, and medical device manufacturers are disclosed, if at all, only in fine print. Corporate hospitals conduct extensive mass-media campaigns featuring named physicians, capitalising on the reputational value of individual clinicians while exposing those clinicians to advertising-related liability that the NMC regulations do not clearly address.
B. Corporate Hospital Advertising and Misleading Claims
The Consumer Protection Act, 2019 and the Central Consumer Protection Authority (CCPA) Rules made thereunder prohibit misleading advertisements that falsely represent the quality, nature, or standard of a service.22 The Advertising Standards Council of India (ASCI), a self-regulatory body, has issued specific guidelines for healthcare advertisements that prohibit false claims of clinical efficacy, before-and-after testimonials that misrepresent likely outcomes, and endorsements by medical professionals that imply guaranteed results.23 Violations of ASCI guidelines may attract CCPA notices under the Consumer Protection Act, 2019, although enforcement remains sporadic and penalties insufficiently deterrent.
A distinctive problem arises from what might be termed “aspirational medicine”the promotion of elective procedures, preventive health packages, and wellness interventions through advertising that is not clinically falsifiable but that systematically overstates benefit and understates risk. Annual health check-up packages, full-body cancer screening programmes, and cosmetic procedures are routinely marketed through testimonials and outcome statistics that do not meet the standards of evidence-based medicine.24 The regulatory gap is that while the ASCI can sanction misleading advertising, it cannot regulate the clinical appropriateness of the services being advertised, a function that falls within the NMC’s mandate but which the NMC has not exercised systematically in the digital media context.
C. Comparative Perspectives on Medical Advertising
A comparative survey reveals a spectrum of regulatory philosophies. In the United Kingdom, the General Medical Council permits factual advertising of medical services but prohibits misleading, inaccurate, or comparative claims, and requires that all advertising be verifiable and consistent with the doctor’s duty of candour.25 The UK Advertising Standards Authority has jurisdiction over all healthcare advertisements, including those on social media, and has issued enforcement decisions against clinicians whose testimonial content cannot be substantiated.26
In the United States, the First Amendment has traditionally constrained state attempts to restrict commercial speech, including medical advertising, beyond narrowly tailored prohibitions on false and misleading claims.27 State medical boards may impose professional discipline for false or misleading advertising, but the underlying First Amendment framework produces a more permissive advertising environment than either the Indian or UK models.
The Indian regulatory model is nominally more restrictive than both comparators but is practically less enforced. The structural recommendation of this article is to modernise India’s medical advertising regulation by replacing the blunt prohibition model with a transparent content-standard model one that permits factual advertising of medical services subject to mandatory disclosure of clinician credentials, outcome data sourcing, and material risks, enforceable by both the NMC’s EMRB and the CCPA in coordination.
AI-ASSISTED DIAGNOSIS AND THE LIABILITY VACUUM
A. The Current Landscape of AI in Indian Healthcare
Artificial intelligence diagnostic tools are in active clinical deployment across the Indian healthcare system. Computer-aided detection tools for radiology, AI-assisted electrocardiogram interpretation, diabetic retinopathy screening algorithms, and sepsis prediction models are used in both public sector programmes and private hospital chains.28 The Ayushman Bharat Digital Mission (ABDM), operationalised under the National Digital Health Mission, has created the infrastructure for large-scale digitisation of health records, generating the training data ecosystems upon which AI systems depend.29 NITI Aayog’s series of reports on responsible AI, including the 2021 Responsible AI for All framework, have acknowledged the healthcare sector as a priority domain for AI deployment and governance.30
The problem is that clinical deployment has substantially outpaced regulatory governance. AI diagnostic tools deployed in Indian clinical settings currently exist in a regulatory grey zone. The Central Drugs Standard Control Organisation (CDSCO), which regulates medical devices under the Medical Devices Rules, 2017 made under the Drugs and Cosmetics Act, 1940, has the statutory authority to classify AI-based Software as a Medical Device (SaMD) and require market authorisation.31 However, the classification criteria have not been comprehensively updated to address the machine-learning-specific risks of training data bias, distributional shift, and model opacity that distinguish AI diagnostic tools from traditional medical devices.
B. The Liability Attribution Problem
When an AI system generates a diagnostic output that leads to patient harm, the legal system faces a question that existing tort doctrine answers only approximately: who bears responsibility? The candidate defendants are the treating physician who relied on the AI recommendation, the hospital that deployed the system, the developer who designed and trained the algorithm, and potentially the data provider whose datasets introduced biased training patterns.
Under existing Indian law, the treating physician bears the non-delegable duty of care established through Samira Kohli and the Jacob Mathew line of authority. If a physician uncritically defers to an AI recommendation without exercising independent clinical judgment, existing doctrine would likely hold the physician liable for the failure to bring the standard of care of a competent clinician to bear on the AI output.32 This analysis preserves physician accountability, but it produces a perverse incentive: if physicians who rely on AI bear the same liability as physicians who do not, rational actors will either avoid AI tools entirelyforgoing their potential patient welfare benefitsor will engage in performative documentation of independent judgment that adds no genuine clinical value.
The hospital institution presents a stronger candidate for primary liability under the Spring Meadows enterprise liability analysis and under Section 2(28) of the Consumer Protection Act, 2019, which introduces product liability applicable to goods that fail to meet safety standards.33 An AI diagnostic tool that generates systematically biased or inaccurate outputs could, in principle, constitute a product that fails the safety standard test, with the hospital as the entity that placed it in the service delivery chain. However, courts have not yet considered AI medical devices under the product liability provisions of the Consumer Protection Act, 2019, and the evidentiary and causal requirements for such claims remain to be judicially developed.
The AI developer occupies the position most analogous to a product manufacturer but raises distinct doctrinal challenges. AI systems trained and validated on datasets that do not adequately represent the Indian patient population a common problem given that most commercially available diagnostic AI has been developed on Western datasets may generate systematically inferior outputs for Indian patients, without any single failure event that could be characterised as a manufacturing defect in the traditional sense.34
C. The Digital Personal Data Protection Act, 2023 and Medical AI
The Digital Personal Data Protection Act, 2023 (DPDPA) introduces comprehensive obligations on entities that process personal data, including health data, which is designated as sensitive personal data requiring heightened protection.35 The consent framework under Section 6 of the DPDPA requires that patients provide specific, informed, and voluntary consent for the processing of their personal data, a requirement directly implicated by the use of patient data to train and continuously improve AI diagnostic models.36 The DPDPA creates a right to withdraw consent under Section 6(4), which raises the practically complex question of whether withdrawal of consent from data processing requires the removal of a patient’s data from an AI model’s training set, a technically challenging and potentially impossible requirement for deployed machine-learning systems.37
The Information Technology Act, 2000 provides additional obligations through Section 43A, which imposes liability on bodies corporate that handle sensitive personal data negligently, and through the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, which establish minimum security standards for health data.38 The intersection of data protection law and AI liability creates a multi-layered compliance obligation that existing hospital compliance frameworks are inadequately equipped to satisfy.
D. International Regulatory Architecture as Comparative Reference
The European Union Artificial Intelligence Act, 2024 (EU AI Act) represents the most comprehensive legislative framework for AI governance currently in force globally.39 The EU AI Act classifies AI systems used for diagnosis, prognosis, and clinical decision support in healthcare as high-risk AI systems under Annex III, subjecting them to mandatory conformity assessments, transparency requirements, human oversight obligations, and post-market monitoring systems before they may be placed in the European market.40 The EU AI Act also imposes obligations of explainability, the requirement that AI outputs in high-risk contexts be traceable and interpretable by the human professional who acts on them that directly addresses the opacity problem identified above.
The United States Food and Drug Administration has developed a regulatory framework for AI/ML-based Software as a Medical Device that includes predetermined change control plans requiring developers to specify in advance the conditions under which an algorithm may be updated and the revalidation that must occur before updated versions are deployed in clinical settings.41 This approach addresses the “continuous learning” challenge of modern AI systems that update their parameters through deployment experience, potentially deviating from the performance characteristics that underpinned their original clearance.
India currently lacks equivalent regulatory instruments. The Medical Devices Rules, 2017 require market authorisation for software that constitutes a medical device, but the Rules were not designed with adaptive AI in mind and do not address explainability, bias testing, or post-deployment performance monitoring. Filling this gap is the most urgent regulatory priority arising from the AI-healthcare intersection.
PROFESSIONAL MISCONDUCT IN THE ERA OF CORPORATE MEDICINE
A. Structural Incentives for Misconduct
The corporatisation of Indian healthcare has transferred effective decision-making authority over clinical practice from individual physicians to institutional administrators pursuing revenue objectives. Corporate hospital chains negotiate procurement agreements with pharmaceutical companies and diagnostic laboratories that create financial incentives for physicians to prescribe certain drugs, refer patients to affiliated diagnostic facilities, and recommend procedures that optimize institutional revenue rather than patient welfare.42 These arrangements, colloquially described as “kickbacks” or “referral commissions”constitute professional misconduct under Regulation 6.4 of the NMC Code of Medical Ethics Regulations, 2002, which prohibits fee-splitting and the receipt of any commission, bonus, or profit-sharing arrangement in connection with the management of patients.43
The clinical consequences of such incentive structures are predictable and documented. Defensive over-testing, driven partly by liability fear and partly by diagnostic facility revenue targets, adds unnecessary cost and generates incidental findings that trigger further investigation cascades, exposing patients to cumulative procedural risk.44 Prescription patterns in corporatised settings show higher rates of branded medication over generics and higher rates of high-cost interventional procedures over conservative management strategies, in a pattern consistent with institutional revenue optimisation rather than evidence-based clinical decision-making.45
B. Enforcement Weakness of the Professional Discipline System
The National Medical Commission Act, 2019 constituted the Ethics and Medical Registration Board (EMRB) under Section 30 as the primary institutional mechanism for professional discipline.46 The EMRB is empowered to receive and investigate complaints against registered medical practitioners, to suspend or cancel registration, and to recommend prosecution in appropriate cases. In principle, this represents a more structured disciplinary architecture than the largely self-regulatory system that preceded the NMC Act.
In practice, the professional discipline system continues to exhibit the structural weaknesses that characterised its predecessor. Complaint processes remain opaque and prolonged; sanctions are disproportionately lenient relative to the severity of the misconduct found; and the institutional relationships between disciplinary bodies and the medical profession create a perception of conflicts of interest that undermines public confidence in the system’s independence.47 The absence of a dedicated health ombudsmanan independent adjudicator with investigative powers, subject-matter expertise, and the authority to order disclosure of institutional data means that systemic misconduct attributable to hospital-level incentive structures is rarely exposed and even more rarely sanctioned.
C. Enterprise Liability and the Externalisation Problem
A fundamental structural problem in Indian medical liability law is that the entity which creates the incentive for misconduct is rarely the entity that bears the legal consequence. Corporate hospital chains establish productivity targets, diagnostic referral requirements, and pharmaceutical partnership arrangements that pressure individual clinicians into conduct that violates professional ethics. When liability materialises, the claim is typically directed at the individual physician, whose professional indemnity insurance absorbs the cost, while the institution that structured the harmful incentive bears no direct legal consequence.48
The enterprise liability model, familiar in United States product liability and employment law, proposes that the entity which controls the conditions of a harmful activity and which benefits from the revenue generated by that activity should bear primary liability for the harms that result from it. Applied to corporate medicine, enterprise liability would hold hospital institutions directly accountable for harms attributable to institutional incentive structures, even where the proximate act was performed by an individual physician acting within those structures.49 The Spring Meadows Hospital decision offers a doctrinal foundation for this position in the Indian consumer law context; what is required is its systematic extension and legislative reinforcement through an amended Clinical Establishments Act, 2010.
COMPARATIVE PERSPECTIVES: LESSONS FROM DEVELOPED JURISDICTIONS
A. The United Kingdom: From Bolam to Montgomery
The evolution of English medical law from Bolam v. Friern Hospital Management Committee50 to Montgomery v. Lanarkshire Health Board51 represents the paradigm shift that Indian law has partially made in Samira Kohli but not yet completed. In Montgomery, the UK Supreme Court abandoned the Bolam standard for the purposes of informed consent, replacing it with a patient-centred test focused on what a reasonable patient would consider material to her decision. The Court explicitly grounded this shift in the changed social context of medicine from paternalism to partnership and in human rights law’s guarantee of patient autonomy.
The Montgomery standard has significant implications for AI-assisted diagnosis. A clinician who uses an AI tool to generate a diagnosis or treatment recommendation must, under a Montgomery-aligned standard, disclose to the patient that AI was used, the nature of the tool, its known limitations, and any known biases relevant to the patient’s demographic profile. This transparency obligation is not yet recognised in Indian law but is implied by the principle of real informed consent developed in Samira Kohli.
B. The United States: Enterprise Liability and the Learned Intermediary
The United States has developed the concept of enterprise medical liability, under which the hospital entity rather than or in addition to the treating physician bears direct liability for systemic failures of care delivery.52 The learned intermediary doctrine, developed in pharmaceutical product liability, holds that a manufacturer’s duty of disclosure to the patient is discharged through disclosure to the prescribing physician. Applied to AI medical devices, US courts and the FDA’s regulatory framework have begun to develop an equivalent principle: that the deploying hospital institution, not only the device developer, bears responsibility for ensuring that clinicians understand the AI tool’s limitations before deploying it in clinical decision-making.
C. The European Union: Risk-Based AI Governance
The EU AI Act’s risk-based approach to AI governance offers the most directly transferable regulatory model for India. By designating medical AI as categorically high-risk, the EU framework imposes conformity assessments, technical documentation requirements, human oversight obligations, and accuracy and robustness standards that apply before market entry rather than through post-hoc tort liability after harm has occurred.53 This pre-market regulatory approach is more efficient than ex post liability in addressing AI risks because it prevents systematic harms rather than merely compensating for them after the fact.
The EU AI Act also introduces a transparency obligation specifically applicable to AI systems that interact with natural persons, requiring disclosure that the person is interacting with an AI system.54 An analogous obligation requiring clinicians to disclose to patients when AI-generated recommendations have influenced their clinical decision would provide meaningful protection for patient autonomy in the Indian context.
TOWARD A RECONSTRUCTED LIABILITY FRAMEWORK: A REFORM BLUEPRINT
The preceding analysis identifies four distinct reform requirements: a modernised medical advertising code; an AI medical device liability and certification regime; institutional enterprise liability for corporate hospitals; and a strengthened professional discipline system. This section proposes specific legislative and regulatory measures for each.
A. Modernising Medical Advertising Regulation
The NMC should revise the advertising provisions of the Code of Medical Ethics to replace the blanket prohibition model with a content-standard model. The revised code should: (i) permit factual advertising of clinical services subject to mandatory disclosure of clinician qualifications, institutional accreditation, and data sources for any outcome statistics cited; (ii) require disclosure of all commercial relationships, including pharmaceutical partnerships and diagnostic laboratory referral arrangements, in any medical content published on digital platforms; (iii) prohibit testimonial advertising that implies guaranteed clinical outcomes; and (iv) extend the EMRB’s disciplinary jurisdiction explicitly to social media content.
The CCPA, acting under Section 18 of the Consumer Protection Act, 2019, should issue sector-specific guidelines for healthcare advertising that align with the revised NMC code and impose monetary penalties calibrated to institutional advertising revenue rather than fixed sums. Coordination between the NMC/EMRB, the CCPA, and the ASCI should be formalised through a joint enforcement protocol that enables shared intelligence on misleading healthcare advertising and coordinated enforcement action.
B. An AI Medical Device Certification and Liability Regime
India requires a dedicated regulatory instrument for AI-based Software as a Medical Device, building on the Medical Devices Rules, 2017 and drawing on the architecture of the EU AI Act. The CDSCO should promulgate AI-specific rules that: (i) require mandatory clinical validation of AI diagnostic tools on datasets representative of the Indian patient population; (ii) mandate algorithmic explainability as a pre-market condition for clinical deployment, the AI system must generate outputs that a trained clinician can interpret, interrogate, and override; (iii) impose post-market surveillance obligations requiring ongoing performance monitoring, mandatory reporting of AI-attributable adverse events, and re-validation following significant algorithmic updates; and (iv) establish a strict liability standard for AI developers and hospital deployers in cases of patient harm attributable to documented algorithmic failure, bias, or inadequate explainability.
The liability allocation scheme should be structured as follows: the AI developer bears primary strict liability for design defects, including training data bias and algorithmic errors; the hospital deployer bears secondary strict liability for deployment failures, including inadequate clinician training, use of the tool outside its validated indication, and failure to maintain compliant post-market monitoring; and the treating physician bears liability for professional negligence in clinical reliance on AI outputs that a reasonable clinician of equivalent training would not have uncritically adopted. This three-tier framework allocates liability to the party best positioned to prevent each category of harm, which is the economic logic that animates efficient liability rules.55
C. Enterprise Liability for Corporate Hospitals
The Clinical Establishments (Registration and Regulation) Act, 2010 should be amended to impose direct institutional liability on corporate hospital chains for harms attributable to institutional incentive structures. Specifically, the amendment should: (i) require mandatory disclosure of all commercial arrangements between hospitals and pharmaceutical companies, diagnostic laboratories, and medical device suppliers; (ii) create a rebuttable presumption of institutional causation where the harm is consistent with the incentive created by an undisclosed commercial arrangement; (iii) impose joint and several liability on the hospital institution alongside any individual clinician found liable for misconduct facilitated by institutional incentives; and (iv) authorise the National Consumer Disputes Redressal Commission to award institutional penalties in class-action proceedings brought by multiple patients affected by the same systemic failure.
Enterprise liability should be complemented by mandatory institutional clinical governance requirements, codified standards for ethical clinical decision-making, prescription audits, and diagnostic necessity reviewbreach of which constitutes per se evidence of institutional negligence in subsequent liability proceedings.
D. A Specialised Health Ombudsman
India should establish a specialised Health Ombudsman with investigative jurisdiction over complaints of medical misconduct, misleading healthcare advertising, and AI-attributable diagnostic harm. The Ombudsman should be empowered to: (i) compel disclosure of clinical records, institutional incentive arrangements, and AI system performance data; (ii) conduct independent investigations without dependence on complainant-provided expert evidence; (iii) award compensation up to a specified threshold, with referral of larger claims to the NCDRC; (iv) recommend professional discipline to the EMRB and regulatory action to the CDSCO; and (v) publish annual reports on systemic trends in medical misconduct and AI-related clinical incidents. The Banking Ombudsman model, established under Reserve Bank of India regulations, provides a procedural template that could be adapted for the health sector.
E. Data Governance and AI Transparency
The DPDPA, 2023 should be supplemented by sector-specific health data rules that address the AI-specific consent and transparency challenges identified above. These rules should: (i) require that consent for the use of patient data in AI training be separately sought and documented, distinct from consent for clinical treatment; (ii) establish a right to human clinical review of any AI-generated diagnosis that materially affects treatment decisions; (iii) require that the use of AI in clinical diagnosis be recorded in the patient’s health record under the Ayushman Bharat Digital Mission framework; and (iv) mandate that AI developers disclose the demographic composition of training datasets to the CDSCO and to deploying institutions, enabling independent bias assessment.
CONCLUSION
India’s medical liability law stands at an inflection point. The doctrine developed through decades of judicial refinement from V.P. Shantha to Jacob Mathew, from Samira Kohli to Common Cause remains sound in principle but inadequate in application to the conditions of contemporary medicine. The physician whose social media following influences clinical demand, the hospital whose AI tool misdiagnoses a rare condition, and the corporate chain whose referral commissions drive unnecessary procedures are not meaningfully regulated by a legal framework designed for the individual clinician with a stethoscope and a prescription pad.
The reform blueprint proposed in this article does not abandon the doctrinal foundations of Indian medical liability; it extends and updates them. The reasonable doctor standard, patient autonomy, and the consumer protection nexus remain sound foundations. What they require is supplementation: a risk-based AI regulatory architecture, an enterprise liability framework that reaches institutional actors, and a modernised advertising code capable of governing digital clinical influence. The principle underlying each of these proposals is the same as the principle that animated the original liability system that medicine must remain, in substance as well as aspiration, a service to the patient rather than a commodity of the market.
India’s scale, demographic diversity, and public health challenges make this reform urgent rather than merely desirable. The patients who will benefit most from AI-assisted diagnosis are those in underserved regions and population groups for whom specialist expertise has historically been inaccessible. Those patients are also the most vulnerable to the harms of biased AI systems, misleading advertising, and institutional profit-seeking that a functional liability framework must prevent. Getting this framework right is not merely a doctrinal exercise; it is a public health imperative.
The law still imagines a stethoscope era in an algorithm age. The imperative of this moment is to imagine forward.
*****
Footnotes
1. Indian Med. Ass’n v. V.P. Shantha, (1995) 6 SCC 651 (India).
2. Jacob Mathew v. State of Punjab, (2005) 6 SCC 1 (India).
3. NMC Code of Medical Ethics Regulations, Regs. 6.1, 6.4 (2002) (India), administered by the Ethics and Medical Registration Board constituted under the National Medical Commission Act, No. 30 of 2019, § 30 (India).
4. Consumer Protection Act, No. 35 of 2019, § 2(11) (India) (defining “deficiency” as fault, imperfection, shortcoming, or inadequacy in the quality, nature, and manner of performance required by law or undertaken to be performed).
5. Jacob Mathew v. State of Punjab, (2005) 6 SCC 1 (India).
6. Bolam v. Friern Hosp. Mgmt. Comm., [1957] 1 WLR 582, 586 (QB) (McNair J.) (“A doctor is not guilty of negligence if he has acted in accordance with a practice accepted as proper by a responsible body of medical men skilled in that particular art.”).
7. Jacob Mathew, (2005) 6 SCC at ¶¶ 47–51.
8. Id. at ¶ 48 (holding that mere inadvertence or an error of judgment in the choice of treatment does not render a doctor criminally culpable).
9. Bharatiya Nyaya Sanhita, No. 45 of 2023, § 106(1) proviso (India) (“Provided that where such act is a rash and negligent medical act done by a registered medical practitioner and the death is caused as a result of such medical act, such practitioner shall be punished with imprisonment of either description for a term which may extend to two years, and shall also be liable to fine.”).
10. Indian Med. Ass’n v. V.P. Shantha, (1995) 6 SCC 651 (India).
11. Consumer Protection Act, No. 35 of 2019, §§ 2(11), 2(42) (India).
12. Kusum Sharma v. Batra Hosp. & Med. Research Ctr., (2010) 3 SCC 480 (India).
13. V. Kishan Rao v. Nikhil Super Speciality Hosp., (2010) 5 SCC 513 (India).
14. Spring Meadows Hosp. v. Harjol Ahluwalia, (1998) 4 SCC 39 (India).
15. Samira Kohli v. Dr. Prabha Manchanda, (2008) 2 SCC 1 (India).
16. Id. at ¶¶ 48–51.
17. Id. at ¶ 57 (adopting a modified patient-centred standard and rejecting the proposition that consent questions are governed purely by the Bolam professional standard).
18. Common Cause v. Union of India, (2018) 5 SCC 1 (India).
19. Nizam Inst. of Med. Scis. v. Prasanth S. Dhananka, (2009) 6 SCC 1 (India).
20. NMC Code of Medical Ethics Regulations, Reg. 6.1 (2002) (India); National Medical Commission Act, No. 30 of 2019, § 30 (India) (constituting the Ethics and Medical Registration Board).
21. NMC Code of Medical Ethics Regulations, Reg. 6.4 (2002) (India).
22. Consumer Protection Act, No. 35 of 2019, § 89 (India) (providing a penalty for misleading advertisements of up to ten lakh rupees for a first contravention and up to fifty lakh rupees for subsequent contraventions); Central Consumer Protection Authority Rules, 2020, r. 3 (India).
23. Advertising Standards Council of India, ASCI Guidelines for Advertisements of Healthcare Professionals and Services (2014, as amended).
24. See Rajib Dasgupta et al., Preventive Health Check-up Packages in India: Interrogating Evidence, Ethics and Equity, 10 J. Global Health 010413 (2020).
25. General Medical Council, Good Medical Practice ¶¶ 68–70 (2024) (U.K.) (requiring that advertising be honest, factual, and avoid unjustifiable claims about clinical services).
26. Advertising Standards Authority (UK), CAP Code § 12 (Healthcare and Medicines) (2023).
27. See Bates v. State Bar of Ariz., 433 U.S. 350 (1977) (establishing First Amendment protection for commercial speech, including professional service advertising).
28. NITI Aayog, Responsible AI for All: Adopting the Framework A Use Case Approach on Healthcare 14–21 (2022) (India).
29. Ministry of Health & Family Welfare, Ayushman Bharat Digital Mission Operational Guidelines (2022) (India); National Health Authority, Health Data Management Policy (2023) (India).
30. NITI Aayog, Responsible AI for All: Adopting the Framework (2021) (India); NITI Aayog, AI in Health: Scoping Paper on AI Applications in Health in India (2022) (India).
31. Drugs and Cosmetics Act, No. 23 of 1940, §§ 3(b), 18 (India) (as amended); Medical Devices Rules, 2017, r. 3(r) (India) (defining “software intended to be used for one or more medical purposes” as a medical device subject to regulatory requirements).
32. Cf. Samira Kohli v. Dr. Prabha Manchanda, (2008) 2 SCC 1, ¶ 48 (India) (affirming that the standard of care requires the exercise of independent clinical judgment).
33. Consumer Protection Act, No. 35 of 2019, §§ 2(28), 84–87 (India) (product liability provisions applicable to defective products that cause harm).
34. See Ziad Obermeyer et al., Dissecting Racial Bias in an Algorithm Used to Manage the Health of Populations, 366 Science 447 (2019) (documenting systematic bias in a commercially deployed clinical risk algorithm attributable to training data composition).
35. Digital Personal Data Protection Act, No. 22 of 2023, §§ 2, 4 (India) (health data constituting sensitive personal data requiring heightened processing obligations).
36. Digital Personal Data Protection Act, No. 22 of 2023, § 6 (India) (consent requirements including specificity, informedness, and voluntariness).
37. Id. § 6(4) (right to withdraw consent); see also Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, r. 5 (India) (imposing an obligation to obtain prior written consent for the collection of sensitive personal data).
38. Information Technology Act, No. 21 of 2000, § 43A (India) (liability for negligent handling of sensitive personal data); Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, r. 8 (India).
39. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act), 2024 O.J. (L) 1689 (entered into force Aug. 1, 2024).
40. Id. art. 6, Annex III, ¶ 5(a) (classifying AI systems intended for use in healthcare as high-risk); arts. 9–16 (setting out requirements for high-risk AI systems including risk management, data governance, transparency, human oversight, accuracy, and robustness).
41. U.S. Food & Drug Admin., Artificial Intelligence/Machine Learning (AI/ML)-Based Software as a Medical Device (SaMD) Action Plan (2021); U.S. Food & Drug Admin., Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence/Machine Learning (AI/ML)-Enabled Device Software Functions: Guidance for Industry and FDA Staff (2024).
42. See Sakthivel Selvaraj & A.K. Karan, Why Publicly-Financed Health Insurance Schemes are Ineffective in India, 47 Econ. & Pol. Wkly. 60, 64 (2012).
43. NMC Code of Medical Ethics Regulations, Reg. 6.4 (2002) (India) (“A physician shall not give, solicit, or receive nor shall he offer to give, solicit or receive, any gift, gratuity, commission or bonus in consideration of or return for the referring, recommending or procuring of any patient for medical, surgical or other treatment.”).
44. See Mandar Muzumdar & Abha Rao, Defensive Medicine and Over-Diagnosis in India: A Growing Concern, 7 Indian J. Med. Ethics 102 (2022).
45. See Anant Phadke et al., Irrational Drug Use in India: A Prescription Survey from Pune, 40 Econ. & Pol. Wkly. 1743 (2005); see also NITI Aayog, Healthy States, Progressive India: Report on the Ranks of States and Union Territories 52–56 (2019) (India).
46. National Medical Commission Act, No. 30 of 2019, § 30 (India) (constituting the Ethics and Medical Registration Board with functions including maintenance of the National Register, oversight of medical ethics, and conduct of disciplinary proceedings).
47. See Sanjay Nagral et al., The National Medical Commission Act: A Critique, 54 Econ. & Pol. Wkly. 17 (2019).
48. See Patricia Danzon, Tort Reform and the Role of Government in Private Insurance Markets, 13 J. Legal Stud. 517, 527 (1984) (discussing liability externalisation in organisational contexts).
49. See Clark Havighurst, Vicarious Liability: Relocating Responsibility for the Quality of Medical Care, 26 Am. J.L. & Med. 7 (2000).
50. Bolam v. Friern Hosp. Mgmt. Comm., [1957] 1 WLR 582 (QB).
51. Montgomery v. Lanarkshire Health Bd., [2015] UKSC 11, [2015] AC 1430.
52. See Kenneth Abraham & Paul Weiler, Enterprise Medical Liability and the Choice of the Responsible Enterprise, 20 Am. J.L. & Med. 29 (1994).
53. Regulation (EU) 2024/1689, arts. 9–16, supra note 39.
54. Id. art. 50 (transparency obligations for AI systems that interact with natural persons).
55. See Guido Calabresi, The Costs of Accidents: A Legal and Economic Analysis 135–52 (1970) (developing the principle that liability should be allocated to the cheapest cost avoider).